william
8db8347df0
The separate Gitea push webhook to Portainer fired in parallel with this build workflow on the same push event, so it could redeploy before the new image finished pushing — Portainer would then pull the still-current :latest tag and silently keep running old code. Removed that webhook; redeploy now only happens as this workflow's last step, after the image push actually completes.
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
name: build-agent
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "agent/**"
|
|
- ".gitea/workflows/build.yml"
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: docker
|
|
# Default auto-token permission on this instance is read-only for packages;
|
|
# pushing to the container registry needs write explicitly.
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Log in to Gitea registry
|
|
# The auto-generated secrets.GITEA_TOKEN doesn't work against the registry's
|
|
# /v2/ auth endpoint regardless of permissions granted (known Gitea limitation);
|
|
# a real personal access token stored as REGISTRY_TOKEN is required instead.
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_HOST }}" \
|
|
-u "${{ gitea.actor }}" --password-stdin
|
|
|
|
- name: Build and push claude-agent image
|
|
run: |
|
|
IMAGE="${{ vars.REGISTRY_HOST }}/${{ gitea.repository }}/claude-agent:latest"
|
|
docker build -t "$IMAGE" ./agent
|
|
docker push "$IMAGE"
|
|
|
|
- name: Trigger Portainer redeploy
|
|
# Deliberately NOT a separate Gitea repo webhook firing in parallel on the same
|
|
# push — that raced with this build and could redeploy before the new image was
|
|
# actually pushed, silently keeping the old code running. Chaining it here as the
|
|
# last step guarantees the image exists before Portainer goes to pull it.
|
|
run: curl -f -X POST "${{ secrets.PORTAINER_WEBHOOK_URL }}"
|